July 2012 Personal Data (Privacy) (Amendment) Ordinance 2012 - Use and Sale of Personal Data for Direct Marketing. Contents Introduction On 27 June 2012, Hong Kong s Legislative Council ( LegCo ) passed the (the Amendment Ordinance ), which was gazetted on 6 July 2012. One of the most important changes to be introduced by the Amendment Ordinance is a restriction on the use of personal data in direct marketing (i.e. the marketing of goods and services by making telephone calls or sending information or goods addressed to specific persons by mail, fax, email or other means of communication). The Amendment Ordinance replaces the current opt-out regime with a new opt-in regime (see the new Part VIA of the Personal Data (Privacy) Ordinance (the PDPO ). Under the new regime, a data user can only use or provide a data subject s personal data to others for use in direct marketing if the data user has provided the requisite information and response facility to the data subject and received the data subject s consent. A failure to comply with the new requirements is a criminal offence. The changes will have important ramifications for every data user who intends to conduct direct marketing or cross-marketing. Introduction... 1 Entry into Force... 1 Use of Personal Data in Direct Marketing... 2 Provision of Personal Data for Use in Direct Marketing (i.e. Cross- Marketing)... 2 What you should do... 3 It is worthy of note that, among other changes, the Amendment Ordinance further increases the power of the Privacy Commissioner. For example, the Privacy Commissioner is now given specific powers to provide assistance to aggrieved data subjects to claim compensation from data users for contravening the PDPO. Entry into Force The Amendment Ordinance will come into effect in phases. The majority of the provisions will come into effect on 1 October 2012. Importantly, the new requirements relating to direct marketing and the Privacy Commissioner s provision of assistance to aggrieved data subjects will come into effect later (on the Commencement Date ), which is currently expected to be in early to mid 2013. This allows the Privacy Commissioner to issue guidance notes and for corporate data users to prepare for the transition. Use and Sale of Personal Data for Direct Marketing 1
Use of Personal Data in Direct Marketing The Amendment Ordinance introduces an opt-in approach in respect of the use of personal data for direct marketing. Subject to the grandfathering arrangement (explained below), the Amendment Ordinance requires data users to take certain specified actions before using personal data in direct marketing, which include: informing the data subject of the intention to use his/her personal data for direct marketing; providing the data subject with specific information about the kinds of personal data to be used and the classes of marketing subjects in relation to which the data is to be used; and providing the data subject with a means (at no cost to the data subject) to communicate the data subject s consent (or no objection ) to the intended use. The information provided must be presented in a manner that is easily understandable (and, if in written form, easily readable). Under a grandfathering arrangement, the new requirements set out above will not, generally speaking, apply to personal data properly collected and used in direct marketing before the Commencement Date. In other words, a data user can continue to use such personal data after the Commencement Date as long as they are used for direct marketing of its own products/services which belong to the same class of products/services as before. Subject to the grandfathering arrangement, data users are strictly prohibited from using personal data in direct marketing unless the relevant data subject s consent (which is revocable) is obtained. It should be noted that where a data subject s consent is obtained orally, the data user must send a written confirmation to the data subject within 14 days. Similar to the present regime, when a data subject s personal data is used in direct marketing for the first time, a data user must inform the data subject of the right to require the data user to cease to use the data. A failure to undertake the requisite actions or to use personal data in direct marketing without the data subject s consent is a criminal offence punishable by a fine of HK$500,000 and imprisonment of up to 3 years. Provision of Personal Data for Use in Direct Marketing (i.e. Cross- Marketing) In addition to enhanced restrictions regarding direct marketing, the Amendment Ordinance introduces specific provisions directed at crossmarketing (i.e. when personal data is sold or otherwise made available to third parties under commercial arrangements for such third parties direct marketing). Use and Sale of Personal Data for Direct Marketing 2
Where cross-marketing is intended, the Amendment Ordinance requires data users to inform the data subject of, among other matters, the intention to provide the personal data, the kinds of personal data to be provided, the classes of persons to whom the data are to be provided and the classes of marketing subjects in relation to which the data are to be provided. If the data is to be provided for gain, that fact must also be explicitly stated. In contrast to the case where the data is used only for one s own direct marketing, in the case of cross-marketing, the data subject must be informed in writing oral notification is not an option. Data users are prohibited from providing personal data to another person for conducting cross-marketing in the absence of the relevant data subject s written consent (oral consent is insufficient). Such consent is revocable. As the grandfathering arrangement does not apply to cross-marketing, this means that after the Commencement Date, no new cross-marketing may take place in Hong Kong unless the new requirements under the Amendment Ordinance are complied with. Contravention of the cross-marketing requirements is a criminal offence punishable by a fine of HK$500,000 and imprisonment of up to 3 years (or a fine of HK$1 million and imprisonment for 5 years if the provision is for gain, i.e. a sale of personal data). What you should do Whilst the Commencement Date has not been set and the Commissioner has yet to publish relevant guidance notes on the new direct marketing regime, in view of the changes, the following preparatory steps are recommended: review the standard personal information collection statement and other relevant terms and conditions for the supply of products or services to determine to what extent they will need to be amended to comply with the new requirements; consider to what extent the grandfathering arrangements will apply to personal data currently held and whether, notwithstanding the grandfathering arrangements, a fresh exercise to obtain consent from relevant data subjects for conducting direct marketing should be conducted; consider whether your organisation intends to conduct crossmarketing in the future (whether with a group entity or an external third party) and if so, whether consent from data subjects need to be obtained and how to obtain such consent; develop or update internal policies and procedures on the use or sale of personal data for direct marketing and cross-marketing in consultation with relevant departments, including front-line marketing staff and the IT department; Use and Sale of Personal Data for Direct Marketing 3
review relevant contracts with data processors and cross-marketing partners to ensure that the contractual provisions comply with the requirements under the Amendment Ordinance; and bear in mind that under the new regime, the Privacy Commissioner may provide legal assistance to data subjects for breach of the PDPO. This may increase the number of complaints (and claims) against data users. We will update you on this subject including notifying you of the announcement of the Commencement Date and the release of relevant guidance notes. Should you have any questions regarding the Amendment Ordinance or other recent Hong Kong data privacy developments (such as the Privacy Commissioner s publication of the guidance note on handling data access request), we would be happy to share our thoughts with you. Use and Sale of Personal Data for Direct Marketing 4
Contacts For further information please contact: Marc Harvey Partner (+852) 2842 4122 marc.harvey@linklaters.com Ivan Chang Managing Associate (+852) 2842 4110 ivan.chang@linklaters.com Author: Marc Harvey and Ivan Chang This publication is intended merely to highlight issues and not to be comprehensive, nor to provide legal advice. Should you have any questions on issues reported here or on other areas of law, please contact one of your regular contacts, or contact the editors. Linklaters. All Rights reserved 2012 Linklaters Hong Kong is a law firm affiliated with Linklaters LLP, a limited liability partnership registered in England and Wales with registered number OC326345. It is a law firm authorised and regulated by the Solicitors Regulation Authority. The term partner in relation to Linklaters LLP is used to refer to a member of the LLP or an employee or consultant of Linklaters LLP or any of its affiliated firms or entities with equivalent standing and qualifications. A list of the names of the members of Linklaters LLP and of the non-members who are designated as partners and their professional qualifications is open to inspection at its registered office, One Silk Street, London EC2Y 8HQ, England or on www.linklaters.com. Please refer to www.linklaters.com/regulation for important information on our regulatory position. We currently hold your contact details, which we use to send you newsletters such as this and for other marketing and business communications. We use your contact details for our own internal purposes only. This information is available to our offices worldwide and to those of our associated firms. If any of your details are incorrect or have recently changed, or if you no longer wish to receive this newsletter or other marketing communications, please let us know by emailing us at marketing.database@linklaters.com. 10th Floor, Alexandra House Chater Road Hong Kong Telephone (+852) 2842 4888 Facsimile (+852) 2810 8133/2810 1695 Use and Sale of Personal Data for Direct Marketing Linklaters.com 5 A15235233/0.7/12 Jul 2012